feat(system-tags): process vs chrome groups + WIP provisional auto-apply (#1464)

Backend for the system-tag behavior refactor (milestone #157). editor screenshot
moves from chrome (hidden) to the PROCESS group (shown, like wip); wip+editor gain
provisional auto-apply so they stop needing endless manual identification —
without a runaway loop.

- tag.py: split PRESENTATION_SYSTEM_TAGS → CHROME_SYSTEM_TAGS (banner) +
  PROCESS_SYSTEM_TAGS (wip, editor screenshot).
- heads.py: generalize presentation_auto_apply_sweep → system_tag_auto_apply_sweep
  (mode chrome|process). Same Guard 1 (skip human/confirmed) + Guard 2 (ring-loud
  conflict → PresentationReview). process mode uses source 'process_auto' and does
  NOT hide (hide is a gallery-query effect of group membership).
- training_data._AUTO_SOURCES += 'process_auto' → the head never trains on its own
  auto-applied output; only wip_title/manual train it (the runaway break).
- ml_settings: process_auto_apply_enabled (OFF, opt-in) + threshold + conflict
  threshold. presentation_review.mode ('chrome'|'process'). Migration 0086.
- gallery_service: default-hide reads CHROME only (editor now shows); Explore
  neighbors exclude the whole PROCESS group.
- tasks/ml + celery beat: scheduled_process_auto_apply (daily, opt-in); prune
  covers both modes.
- api: ml_admin process_* CRUD+validation; hidden-review returns mode.
- tests: rename chrome sweep calls; new test_process_auto_apply (apply, guards,
  mode flag, no-self-train); gallery test asserts editor now visible.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/app/models/ml_settings.py

@@ -85,12 +85,14 @@ class MLSettings(Base):
         Float, nullable=False, default=0.95
     )
     # -- Presentation chrome auto-hide (#141) -------------------------------
-    # banner / editor screenshot auto-apply on the sweep with their OWN flat
-    # threshold (decoupled from content-head graduation). Hiding is consequential
-    # so it runs HIGH. `wip` is never auto-applied. When an image would be
-    # auto-hidden but ALSO scores >= presentation_conflict_threshold on a content
-    # head, it's still hidden but flagged for review (PresentationReview) instead
-    # of buried silently. ON by default (opt-out); every auto-tag is reversible.
+    # `banner` (chrome — clusters on UI, not content) auto-applies on the sweep
+    # with its OWN flat threshold (decoupled from content-head graduation) and is
+    # HIDDEN from the gallery. Hiding is consequential so it runs HIGH. When an
+    # image would be auto-hidden but ALSO scores >= presentation_conflict_threshold
+    # on a content head, it's still hidden but flagged for review
+    # (PresentationReview, mode='chrome') instead of buried silently. ON by default
+    # (opt-out); every auto-tag is reversible. NOTE (#1464): `wip` + `editor
+    # screenshot` are no longer chrome — they went to the PROCESS path below.
     presentation_auto_apply_enabled: Mapped[bool] = mapped_column(
         Boolean, nullable=False, default=True
     )
@@ -100,6 +102,26 @@ class MLSettings(Base):
     presentation_conflict_threshold: Mapped[float] = mapped_column(
         Float, nullable=False, default=0.50
     )
+    # -- Process auto-apply (#1464) ----------------------------------------
+    # `wip` / `editor screenshot` are PROCESS art — unfinished pieces + program
+    # screenshots that must stay OUT of head/CCIP training but, unlike chrome,
+    # remain VISIBLE in the gallery (operator 2026-07-12). They auto-apply on the
+    # sweep with their OWN flat threshold and a PROVISIONAL source (`process_auto`,
+    # in training_data._AUTO_SOURCES) so the head NEVER trains on its own output —
+    # it learns only from title (`wip_title`) + manual labels, which breaks the
+    # runaway loop. When a process tag would be applied but the image ALSO scores
+    # >= process_conflict_threshold on a content head, it's flagged for review
+    # (PresentationReview, mode='process') rather than silently marked. OFF by
+    # default — a new whole-library auto-tagger is opt-in; every auto-tag reversible.
+    process_auto_apply_enabled: Mapped[bool] = mapped_column(
+        Boolean, nullable=False, default=False
+    )
+    process_auto_apply_threshold: Mapped[float] = mapped_column(
+        Float, nullable=False, default=0.90
+    )
+    process_conflict_threshold: Mapped[float] = mapped_column(
+        Float, nullable=False, default=0.50
+    )
     # Default = SigLIP 2 (so400m, 512px) for new installs (migration 0069);
     # existing libraries keep their stored value until the operator re-embeds.
     embedder_model_version: Mapped[str] = mapped_column(

backend/app/models/presentation_review.py

@@ -1,15 +1,17 @@
-"""PresentationReview — an auto-hidden presentation tag that ALSO looked like
-real content, flagged for operator review (milestone 141).
+"""PresentationReview — a system-tag the auto-apply sweep applied that ALSO looked
+like real content, flagged for operator review (milestone 141 + #1464).
 
-When the auto-apply sweep hides an image as chrome (banner / editor screenshot)
-but the image ALSO scores highly on a content head, it still hides it but records
-this row so the Hidden view can surface it ("⚠ also looks like <conflict tag>")
-for a keep-hidden / un-hide decision. Resolved rows are pruned by retention.
+When a sweep applies a system tag but the image ALSO scores highly on a content
+head, it still applies the tag but records this row so a review strip can surface
+it ("⚠ also looks like <conflict tag>"). Two modes (#1464): 'chrome' (banner —
+image is HIDDEN, review is keep-hidden / un-hide) and 'process' (wip / editor
+screenshot — image stays VISIBLE, review is confirm / remove-tag). Resolved rows
+are pruned by retention.
 """
 
 from datetime import datetime
 
-from sqlalchemy import DateTime, Float, ForeignKey, func
+from sqlalchemy import DateTime, Float, ForeignKey, String, func
 from sqlalchemy.orm import Mapped, mapped_column
 
 from .base import Base
@@ -31,6 +33,12 @@ class PresentationReview(Base):
         ForeignKey("tag.id", ondelete="SET NULL"), nullable=True
     )
     conflict_score: Mapped[float] = mapped_column(Float, nullable=False)
+    # Which sweep flagged this (#1464): 'chrome' (banner, hidden) or 'process'
+    # (wip / editor screenshot, shown). Drives which review strip surfaces it and
+    # what "resolve" means (un-hide vs remove-tag). Existing rows backfill 'chrome'.
+    mode: Mapped[str] = mapped_column(
+        String(16), nullable=False, default="chrome", server_default="chrome"
+    )
     created_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True), nullable=False, server_default=func.now()
     )

backend/app/models/tag.py

@@ -43,14 +43,19 @@ class TagKind(StrEnum):
     # to keep historic tag rows queryable.
 
 
-# The seeded system tags (migration 0075). PRESENTATION tags additionally
-# hide from whole-image similarity results — they cluster on UI chrome, not
-# content. `wip` is real art: only the training pipelines exclude it.
+# The seeded system tags (migration 0075). Two behavior groups (#1464):
+#   CHROME (banner): clusters on UI chrome, not content → HIDDEN from the default
+#     gallery + from similarity; auto-applied via the sweep's chrome mode.
+#   PROCESS (wip, editor screenshot): real-but-unfinished art / program screenshots
+#     → SHOWN in the gallery (operator 2026-07-12), but excluded from the Explore
+#     rabbit-hole; auto-applied via the sweep's process mode (provisional source,
+#     ring-loud review guard).
+# ALL three are excluded from OTHER concepts' head/CCIP training (training-hygiene,
+# keyed on is_system); a system tag's OWN head trains on them — that's what makes
+# auto-flagging work.
 SYSTEM_TAG_NAMES = ("wip", "banner", "editor screenshot")
-PRESENTATION_SYSTEM_TAGS = ("banner", "editor screenshot")
-# `wip` marks real-but-unfinished art. It's kept in the gallery's own "similar"
-# results (#1274), but the Explore rabbit-hole opts to hide it (exclude_wip) so a
-# browse doesn't keep surfacing work-in-progress (operator, 2026-07-08).
+CHROME_SYSTEM_TAGS = ("banner",)
+PROCESS_SYSTEM_TAGS = ("wip", "editor screenshot")
 WIP_SYSTEM_TAG = "wip"
 
 image_tag = Table(